Memory Forensics in Incident Response Flashcards
(251 cards)
1
Q
When did the change from rudimentary string searching to recovering process information in memory forensics?
A
The DFRWS 2005 challenge.
2
Q
At what event did many professionals agree that “pulling the plug” is no longer acceptable?
A
The SANS Forensics Summit in 2008. (p8)
3
Q
Why do some guides still recommend pulling the plug instead of performing memory forensics?
A
A lot of the guides are distributed to people with absolutely no computer training (law enforcement).
4
Q
Why are memory forensics important?
A
Nearly everything of interest traverses RAM.
5
Q
Why is memory becoming less volatile and more like a secondary file system?
A
It’s becoming larger.
6
Q
What are volatile registry keys?
A
Registry keys that can be updated and only survive in memory.
7
Q
p12 needed?
A
?
8
Q
What is \Device\PhysicalMemory?
A
A handle in the Windows filesystem that, prior to Windows 2003 SP1, could be used to address and copy physical memory.
9
Q
When did \Device\PhysicalMemory go away?
A
Windows 2003 SP1
10
Q
What is HIPS?
A
Host Intrusion Protection Software
11
Q
When do Windows drivers have to be signed?
A
64 bit systems
12
Q
How do you access physical memory on Windows systems?
A
Pre 2003 SP1, \Devices\PhysicalMemory. Post 2003 SP1 requires a driver.
13
Q
What is WinPMEM?
A
A memory dumping tool for Windows. It allows read only or read write access.
14
Q
What is Redline?
A
A tool that is used for Windows memory analysis. Can also perform live memory analysis.
15
Q
How can you perform memory analysis on a system that’s already been shut down?
A
Copies of ram that are automatically created, like hibernation files in Windows. Crash dump files as well.
16
Q
What is the filename that Windows uses to create a copy of memory when the system goes into hibernation?
A
hiberfil.sys
17
Q
What portions of memory are included in hiberfil.sys?
A
Everything. It’s a complete copy.
18
Q
What is a Windows crash dump file named?
A
memory.dmp in %WINDIR%. If it’s a full crash dump, it’ll be a complete copy of memory. (See footnotes on p14)
19
Q
Why is analysis of chat applications difficult?
A
Many don’t log communications to disk, so the only place to find the information may be in memory.
20
Q
What is DumpIt?
A
A simple memory dumping tool from MoonSols that dumps memory from 32 or 64 bit Windows systems to the curent working directory.
21
Q
Where’s the best place to run DumpIt.exe?
A
A large capacity thumb drive, because it dumpts to CWD.
22
Q
What does DumpIt cost?
A
It’s free.
23
Q
How is memory usually stored on disk with virtualization products?
A
It’s often a raw copy of memory, so can be analyzed with standard memory analysis tools.
24
Q
In which virtualization products is the on-disk memory image a copy of raw memory?
A
VMWare, Microsoft Server 2008 Hyper-V, and Parallels.
25
How is the on-disk memory image for VirtualBox different from most other virtualization products?
It only holds memory in use, not a complete image of memory. (16)
26
What is the fallback plan to analyze memory on a virtual machine if the on-disk image analysis won't work?
Run a memory acquisition tool within the virtual guest.
27
What product can be used to analyze virtualization product memory?
Volatility
28
What are the common file suffixed for virtual memory files?
```
.vmem - VMware raw memory
.vmss - VMware contains memory image
.vmsn - VMware contains memory image
.bin - Microsoft Hyper-v memory image
.vsv - Microsoft Hyper-v save state
.mem - Parallels raw memory image
.sav - VirtualBox partial memory image
(16)
```
29
Where are memory images found?
p16.
30
Rajid Mitra case
p18
31
What is hiberfil.sys?
A Windows hibernation file a compressed copy of RAM at the time of hibernation.
32
How can you decompress hiberfil.sys?
Volatility's imagecopy or MoonSols hibr2bin.exe
33
What files can analyze Windows hibernation files natively?
BulkExtractor
Magnet Forensics Internet Evidence Finder
Volatility
Belkasoft Evidence Center
34
What windows command line tool manages hibernation files?
powercfg.exe (review the options p 20)
35
What is memory forensics?
Study of data captured from memory of a target system, including RAM and virtual memory.
36
How is memory analysis different from traditional media forensics?
* Data is a snapshot in time, with dramatic changes possible moment to moment
* Complicated to establish context because there's more information than just files and directories
* Data is formatted for execution, not to be extracted and understood, so analysis is more complicated.
37
How is memory analysis similar to media forensics?
* Still requires forensically clean procedure
* Still requires putting memory in context, but memory has a more complicated architecture than disk filesystems.
* Still requires analyzing the raw results to understand what the data means
38
Why is forensic capture of memory more complicated than of media?
Executing a program to capture memory modifies memory.
39
What is the KDBG?
Kernel Debugger Datablock (lots more on p.24)
40
What are the three traditional malware detection methods?
Signature, contradiction, heuristic/behavioral (26)
41
What are the processes to find the first hit in memory analysis?
1. Identify rogue processes
2. Analyze process DLLs and handles
3. Review network artifacts
4. Look for evidence of code injection
5. Check for rootkit signature
6. Dump suspicious processes and drivers
42
Redline
p. 27-
43
EPROCESS blocks
p. 35-
44
Analyzing processes
p. 37
45
How does Redline identify rogue processes?
p. 40-
46
What is MRI?
Malware Risk Index. (42)
47
What are the two components in MRI?
1. Behavior rule set
| 2. Verification of digital signatures
48
What are the three types of rules in the behavior rule set?
1. Process path verification
2. Process user verification
3. Process Handle Inspection (does a process like svchost have a handle to cmd.exe?)
4. DLL load order issues (evidence of DLL hijacking)
49
What is required for Redline digital signature checking?
It can only be done in live memory analysis.
50
What other things does Redline check for?
1) Unmapped processes
2) Processes started by command shell
3) DLL load order/hijacking
4) Expected command line arguments
51
Redline heirarchical process view?
p48
52
HBGary Responder product?
p48
53
What things should you check all processes for?
1) Correct image/executable names
2) Correct file location (path)
3) Correct parent process
4) Correct command line and parameters
5) Start time information
6) Security identifies (SID)
54
What is the Windows per-process limit on kernel handles?
2^24 (52)
55
What is a handle in windows?
A pointer to a resource such a file directory registry key, mutex or semaphore, or event.
56
What are the components of a process in Windows?
DLLs, handles, threads, memory sections sockets.
57
What is a VAD?
In Windows, it's a Virtual Address Descriptor tree and maintains a list of assigned memory sections.
58
What is a socket?
A network connection endpoint.
59
What process does Conflicker/Kido inject itself into?
svchost.exe
60
How can you detect Conflicker/Kido?
Only by looking at process objects. Because it uses injection into svchost.exe, SID, launch time, path, and parent process are normal.
61
What is Least Frequency of Occurrence?
The principle that anything related to malware should be uncommon on a system or enterprise. Sorting a list based on occurrences and looking at the least frequently occuring items can be useful. (56)
62
If an object appears in one process, what does that mean?
It might be a sign of malice, but not always. There are legitimate objects that only appear in one windows process.
63
How many signatures does Redline ship with?
Less than 50, but you can create your own.
64
Poison Ivy Remote Access tool?
(62)
65
Creating redline signatures?
(62)
66
List network artifacts
* suspicious ports
* suspicious connections
* suspicious processes (should it be communicating over the network at all?)
67
What are some examples of unusual network behavior?
A non-browser communicating over port 80/443/8080
A browser communicating over a port other than 80/443/8080.
Connections to unexplained IP addresses
Web requests directly to an IP
RDP connections (3389) particularly from odd IPs.
DNS requests for unusual names
68
How are RDP connections usually managed?
They're usually routed through a VPN concentrator.
69
What is TDL3/TDSS?
(69)
70
Redline memory string analysis
(71)
71
What things should you search for in memory?
Known bad IPs, domains, or filenames. http://, https://, ftp:/.
72
Zeus
(71)
73
How common is DLL injection in modern malware?
Very common.
74
How does DLL injection work?
Allocate space in a running process, shove the DLL into it, create a new thread to load the DLL into the process.
or
Hook a process's filter functions using SetWindowsHookEx().
75
How do you load a DLL into a running process?
VirtualAllocEx()
| CreateRemoteThread()
76
What is the symptom of DLL injection?
An unnamed memory section containing executable code attached to a victim process.
77
What is process hollowing?
Start a copy of a legitimate system process, pause the process, de-allocate some of the original code and replace it with malicious code.
78
What is the advantage of process hollowing?
It retains the original executable's process image name, path, and command line. Camouflage.
79
How is a memory page marked executable?
Page_Execute_ReadWrite (72)
80
What does it mean for a memory page to be unmapped?
It's not backed by a file on disk.
81
How do you identify process hollowing?
If the image binary is not backed by a file on disk (unmapped), it's a strong indicator of process hollowing. (77)
82
Zeus
(78-9)
83
Stuxnet
(83-5)
84
Process hollowing example
(83-5)
85
Why have malware authors resorted to techniques like hiding in plain sight?
More advanced techniques like code injection are easy to find with memory analysis, and tools like Redline makes it easy.
86
How do most rootkits work?
By hooking legitimate system functions and redirecting output.
87
What is SSDT?
The System Service Descriptor Table (89)
88
What is IDT?
(89)
89
What is IAT?
(90)
90
What is IRP?
(90)
91
Storm/SSDT hooking
(91)
92
Commonly hooked functions?
NtEnumerateKey
NtEnumerateValueKey
NtQueryDirectoryFile
(91(
93
Why is it hard to identify malicious I/O Request Packet hooks?
There are so many legitimate hooks that have to be eliminated first. Lots of 3rd party drivers.
94
What is a good method to identify malicious I/O Request Packet hooks?
Least Frequency of Occurrence. Most malware hooks sparingly and may hook functions that no or few other applications do.
95
What is the Storm Worm?
A spam bot.
96
How does Storm hide network activity?
It hooks IRP_MJ_DEVICE_CONTROL function within tcpip.sys.
97
openports?
93
98
What does a rootkit do?
It hides the existence of system object like processes, files, registry keys, and network artifacts.
99
How do you dump a process in Redline?
Processes tab in Analysis Data Pane, double click the process of interest within the Table View pane and select MRI Report from the Full Detailed Information tabs at the bottom fo the window. That contains "Acquire Process Address Space"
100
Where does Redline dump a process memory image?
By default %user profile%\AppData\Local\Temp\AgentAcquisition in a password protected zip archive (prevents AV quarantining)
101
Driver aquisition
99
102
What does \\??\ indicate?
An "extended length path" in Windows. (99)
103
What options exist for analyzing a process and drivers once they've been extracted?
* Scan for malware
| * Study the assembly code (ugh...)
104
What does virustotal.com do?
Scans a file with over 40 different AV engines.
105
Is there a drawback to virustotal.com?
Anything you upload is public domain. A safer option is to upload a MD5 of the suspect file.
106
List free, automated tools for examining extracted binaries.
Threat Expert and GFI Sandbox.
107
What are the benefits of live memory analysis?
* Faster triage
* Includes the system pagefile
* More accurate heuristic matching
* Digital signature checks of process executables, DLLs, drivers with a known good whitelist
* Indicator of Compromise searches using pre-defined IOC files.
108
Why is live analysis effective at defeating advanced malware?
It accesses physical memory, not relying on API calls, open handles, or debuggers.
109
What is Shadow Walker?
Proof of concept code that pages itself out of memory when a memory acquisition tool is detected. (107)
110
107 last para
x
111
p 108-118
x
112
What is Volatility?
A framework for performing digital investigations on Windows, Linux, and Mac memory images. (121)
113
Where can you get Volatility?
It's open source, from https://code.google.com/p/volatility/
114
Where is the command reference for Volatility?
The Volatility wiki: https://code/google.com/p/volatility/wiki/CommandReference23 (for version 2.3)
115
What is volatility written in ?
Python
116
How do you execute Volatility?
vol.py -f [image] [plugin] --profile=[PROFILE]
117
What are plugins for in volatility?
They tell the program what to do.
118
What are profiles for in Volatility?
They specify which operating system version you're analyzing.
119
How can you pre set the memory image information in Volatility?
Use the VOLATILITY_LOCATION environment variable.
For example export VOLATILITY_LOCATION=file://(path)
120
What Volatility plugin will determine what operating system a memory image came from?
imageinfo (p124)
121
What flag in Volatility gives help?
-h
122
Where do you find the Volatility options in the SANS books?
Book 2 p. 125.
123
Where do you find the list of all volatility plugins in the SANS books?
Book 2, p. 126-9.
124
What is Rekall?
A fork of Volatility that focuses on speed and performance.
125
How do you execute Rekall?
rekall -f memory.img psscan (130)
126
What is GRR?
Google Rapid Response (research this) p. 130.
127
Which memory forensics tool requires an OS profile and which doesn't?
Volatility does, Rekall doesn't.
128
Which memory forensics tool tends to lead in supporting OS versions out of Volatility and Rekall?
Rekall
129
What is winpmem and osxpem?
p. 130
130
Where can you get rekall?
https://code.google.com/p/rekall
131
What does the imageinfo plugin do?
It's a Volatility plugin that returns information like system date and time when the image was collected, KPCR, number of processors, operating system and service pack information.
132
How can you speed up most Volatility plugins?
Give them the location of the KDBG using -g 0xADDRESS. Use imageinfo to get it.
133
How do you find the KDBG address in Volatility?
imageinfo. Also the virtual address of the KdCopyDataBlock found via the kdbgscan plugin.
134
What is imagecopy?
A volatility plugin that prepares non-standard memory images for analysis.
135
What tool other than imagecopy can be used to convert hibernation images?
hibr2bin.exe (134)
136
What are the parameters to Volatility's imagecopy?
-f -O
137
What Volatility plugins can be used to identify rogue processes?
pslist
psscan
pstree
pstotal
138
Review Rogue Process plugins in Volatility
(138)
139
What does Volatility's pslist doe?
Print all running processes by following the EPROCESS linked list (even in LInux?)
140
What are the important parameters of pslist?
-p (show information for specific process IDs)
141
What does Volatility's pslist provide for each process?
```
Virtual offset of EPROCESS block
Process name
Process ID (PID)
Parent Process ID
Number of threads
Number of handles
Process start time
```
142
What limitation does pslist have?
Rootkits can unlink malicious processes from the linked list rendering them invisible (really? how do they run?)
143
How can you identify a terminated process?
It should have zero handles and zero threads.
144
Note: Finding a system process with a terminated parent is suspicious.
.
145
What is psscan?
A Volatility plugin that scans physical memory for EPROCESS pool allocations.
146
What important parameters does psscan have?
None.
147
How does psscan differ from pslist?
Psscan scans memory rather than following the EPROCESS list, so it can find unlinked/hidden processes, and processes that are no longer running.
148
What information does psscan provide?
```
Physical offset of EPROCESS block
Process name
Process ID
Parent Process ID
Page directory base offset (PDB)
Process start time
Process exit time
```
149
What's the difference between a physical memory offset and a virtual memory offset?
(143)
150
What is -p for Volatility plugins?
Process ID
151
What is -o usually used for in Volatility plugins?
Physical offset in memory
152
What does a process appearing more than once in psscan results likely mean?
Just that it was moved around in physical memory.
153
What is pstree?
A volatility plugin that displays the process list as a tree.
154
What important parameters does pstree have?
-v for verbose information including image path and command line for each process.
155
What limitation does pstree have?
It uses the EPROCESS linked list, so doesn't show unlinked/hidden processes.
156
What is pstree useful for?
Visually identifying malicious processes spawned by the wrong parent process.
157
What information does pstree provide?
```
Virtual offset of EPROCESS block
Process name
PID
PPID
Number of threads
number of handles
process start time
(146)
```
158
What is pstotal?
A Volatility plugin that scans physical memory for EPROCESS pool allocations and identifies hidden processes only found in psscan output.
159
What important parameters does pstotal have?
- -output-file=OUTPUT FILE
- -output=dot for vector capable output
- c or --cmd to display command line including path
160
What do the pstotal color outputs mean?
Red - Process is absent from pslist and has no exit time. Investigate.
Grey - Process is absent from pslist but has an exit timestamp. Probably just an exited process.
Light blue - Exit time is before the most recent boot. Probably leftover in memory image.
Dark blue - Exit time is after the most recent boot
Yellow - Indication of potential PID reuse.
161
What should you check all processes for when trying to identify rogue processes?
```
Correct image/executable name
Correct file location (path)
Correct parent process
Correct command line and parameters
Correct start time information
```
162
What Volatility plugins can be used for analyzing process objects?
```
dlllist
cmdline
getsids
handles
filescan
svcscan
cmdscan
consoles
```
163
What is dlllist?
A Volatility plugin that displays loaded DLLs and the command line to start each process.
164
What important parameters does dlllist have?
-p
165
How can you get the base offset for a DLL?
Use the Volatility dlldump plugin.
166
What is a PEB?
Process Environment Block (156)
167
What does dlllist provide for each DLL?
Base offset
DLL size
DLL file path
168
What plugin can provide more information about DLLs than dlllist?
ldrmodules (156, more)
169
What is getsids?
A volatility plugin that displays Security IDentifiers for each process?
170
What important parameters does dlllist have?
-p
171
What is S-I-5-18?
The SID for LocalSystem (161)
172
What is S-I-5-32-544?
The SID for Administrators
173
What is S-I-1-0
The SID for Everyone
174
What is S-I-5-11?
The SID for Authenticated Users
175
What is S-I-16-16384
The SID for System Mandatory Level
176
Read "How access tokens Work"
http://technet.microsoft.com/en-us/libraray/cc783557(v=ws.10).aspx
177
What is S-I-5-32-546?
The SID for Guests
178
What is S-I-5-32-545?
The SID for Users.
179
SIDs are unique within...?
A Windows instance. Domain SIDs are unique throughout the enterprise.
180
What are the three most popular SIDs?
LocalSystem, LocalService, NetworkService.
181
What does the Volatility module handles do?
Prints a list of handles opened by a process
182
What are the important parameters for the handles Volatility module?
- p PID (can comma separate multiple)
| - t type (there are about a dozen on p 165.)
183
What other Volatility module besides handles can be used for more rigorous searching of file handles and mutants?
mutantscan
184
What does the Volatility svcscan module do?
Scans memory image for Windows service records, giving information on associated processes and drivers
185
What are the important parameters for the svcscan Volatility module?
-v (show service DLL)
186
What is a common persistence mechanism for malware?
Windows Service
187
What should be considered suspicious if found using Volatility's svcscan module?
SERVICE_AUTO_START entries should be examined.
188
What is one method for finding malicious drivers?
Drivers can be loaded via a service, so can be found using Volatility's svcscan module.
189
What method can identify processes stopped by malware?
Volatility's svcscan module.
190
What capability does Volatility have that Redline doesn't?
Enumeration of services
191
What is a Windows Service?
A special type of process that is intended to be run in the background without user input.
192
Windows Services canload...
...both process executables and drivers.
193
What is the only memory analysis tool that can identify services?
Volatility.
194
What information does svcscan provide?
```
Offset
Order
Start method (Disabled, System_Start, Boot_Start, Auto_Start, Demand_Start)
Process ID
Service Name
Display Name
Type (Process or driver)
State (Running or stopped)
Full path
```
195
What does the -v option to svcscan do?
Identifies what DLL started a service by parsing the SYSTEM\CurrentControlSet\Services\\Parameters\ServiceDLL registry key.
196
Other than finding malicious services, what is important to do when reviewing the services that were running when a memory image was captured?
Also identify services which should be running, but which have been stopped.
197
What services might malware stop?
Windows updates and antivirus. (170)
198
What does SERVICE_AUTO_START indicate?
That a service will start on system boot.
199
What is the wuaserv service?
(171)
200
What are cmdscan and consoles?
Volatility modules that carve out full command histories and text console output from a memory image.
201
What is csrss.exe?
173
202
What is conhost.exe?
173
203
How does cmdscan and consoles work?
By scanning the VAC tree of csrss.exe and conhost.exe, in particular the DOSKEY command history buffer kept by cmd.exe.
204
How many entries does cmd.exe keep in its buffer by default?
50
205
What structure does consoles look for?
CONSOLE_INFORMATION
206
What is CONSOLE_INFORMATION?
A memory structurethat includes the console buffer, showing input and output those commands generated. It is parsed by the consoles Volatility plugin.
207
What's the difference between cmdscan and consoles?
Consoles only parses records from consoles active when memory was dumped. cmdscan can recover current and old remnants of command history buffers.
208
What information does cmdscan provide?
Command process (where was history information found)
PID
CommandHistory (offset where history structure found)
(more on 174)
209
What information does consoles provide?
175
210
What process objects might provide a clue something is amiss?
DLLs, Handles, Services.
211
What Volatility plugins provide network artifacts?
```
connections
connscan
sockets
sockscan
netscan
```
212
What is notable about the network artifact plugins in Volatility?
They're the only ones that are operating system dependent. Radical changes were made starting in Vista. With Vista or later netscan must be used.
213
What do connections and connscan do?
They are Volatility plugins that identify network connections.
214
What does the Volatility connections plugin do?
It wanks the TCP connections singly linked list to find active network connections when the memory image was taken.
215
What does the Volatility connscan module do?
It takes a brute force approach scanning anything in memory that resembles a _TCPT_OBJECT and tries to parse it.
216
What is a drawback of connscan?
It attempts to parse objects which might no longer be in use, and which might have been partially overwritten. The results can be incorrect.
217
What information does the connscan and connections plugin provide?
memory offset
local ip address
remote ip address
PID
218
What network artifact can signal a malicious process?
A PID that shouldn't be communicating on the network but that is. A legitimate PID that exhibits this behavior may have been compromised.
219
What is the effect of hibernation on Windows connections?
They're all closed prior to hibernation, so connscan is still effective, but connections wouldn't return any results.
220
What should the network profile of svchost.exe be?
It generally shouldn't have any external connections.
221
What do the sockets and sockscan modules do?
They're Volatility plugins that enumerate network sockets.
222
What does the sockets plugin do?
It walks the singly linked list and reports information on the socket objects.
223
What does the sockscan module do?
It scans memory images looking for _ADDRESS_OBJECT objects and parses them.
224
What information does sockets and sockscan provide?
182
225
What is an important bit of information in the socket structure, and why?
Creation time.
| A process with a passive listening socket on a suspicious port.
226
What can you learn by comparing sockets and sockscan output?
Which sockets were alive and which were terminated or unlinked.
227
What should you focus on when reviewing network artifacts?
Suspicious ports
Suspicious connections
Known bad IPs
Suspicious network behavior from processes
Interesting creation times of network sockets
228
What happens if you use the wrong module for network artifact scanning in Volatility?
No errors are generated, so you can use the wrong one without realizing it.
229
What automated analysis plugins exist for Volatility
```
malsysproc
openioc_scan
baseline
processbl
servicebl
driverbl
```
230
What does malsysproc do?
Automatically identifies suspicous processes
231
What does openioc_scan?
Scans memory objects using OpenIOC signature files.
232
What does baseline do?
Provides processbl servicebl, driverbl for baseline comparisons.
233
What does processbl do?
Compare processes and loaded DLLs with a baseline image.
234
What does servicebl do?
Comapres services with a baseline image.
235
What does driverbl do?
Compares drivers with a baseline image.
236
What is malsysproc designed to do?
Scan system processes for anomalies to find malware pretending to be legitimate system processes.
237
Limitations of malsysproc?
Only scans common system processes (smss, csrss, winlogon, services, lsass, svchost, spoolsv, wininit), and common misspellings. (188)
238
What does malprocfind do?
It's a fork of malsysproc that adds useful checks like anomalous process SIDs and process hollowing.
239
What does baseline do?
Compares memory objects found in a suspect image to those present in a known good image.
240
What parameters does baseline take?
- B (baseline image)
- U (only show items not found in the baseline)
- K (only show items present in the baseline) (190)
241
190
190
242
List Volatility code injection plugins
malfind, ldrmodules
243
What does malfind do?
It's a Volatility plugin that scans process memory sections looking for indications of code injection, then extracts those sections for further analysis.
244
What parameters does malfind take?
195
245
195
195
246
MZ portable executable header?
196
247
PAGE_EXECUTE_READWRITE?
Is this suspicous in itself? (202)
248
What assembly identifies a function?
PUSH EBP
| MOV EBP, ESP
249
What does ldrmodules do?
(203)
250
Volatility rootkit identification plugins
(210)
251
DKOM
211
